AML Alert Triage

Alert ID

Customer Name

Amount (EUR)

Currency

Transaction Type

Origin Country

Destination Country

System Risk Level

Prior SARs

Alert Rule

Enrich — CRM/KYC lookup: customer tenure, risk rating, transaction history, prior SARs

Screen — OpenSanctions API: EU/UN/OFAC/HMT lists, PEP check, match score & datasets

Score — Deterministic risk engine: country matrix, amount thresholds, structuring detection, SAR history

Route — Policy rules: auto-clear (<30), auto-escalate (>70 or sanctions), analyst review (borderline)

Notify — Slack Block Kit alert + task_set_status / task_request_approval (HITL)

Select a scenario above to see expected results.

Scenario A — Stefan Kreuzer

Enrich: 12yr customer, Low risk (12/100), 0 SARs, domestic SEPA-only history

Screen: 0 results from OpenSanctions — clean

Score: ~8/100 — domestic SEPA, low amount, low customer risk

AUTO-CLEAR — false positive. Routine transaction matches customer profile.

Scenario B — Arkady Rotenberg

Enrich: 8mo customer, High risk (82/100), shell company links, 0 SARs

Screen: SANCTIONS HIT — score 1.00, topics: sanction/oligarch, datasets: eu_travel_bans, gb_hmt_sanctions, ukraine_nsdc

Score: 98/100 — sanctions override + Iran destination (40pts) + international wire (10pts)

AUTO-ESCALATE — SAR recommended. Mandatory reporting triggered.

Scenario C — Maria Santos

Enrich: 3yr customer, Medium risk (48/100), cash-heavy business, 1 prior SAR (2024, cleared)

Screen: PEP MATCH — score 0.91, Brazilian politicians, role.pep

Score: ~58/100 — structuring (€9,500, +20pts) + cash (+15pts) + prior SAR (+15pts) + PEP (+20pts)

ANALYST REVIEW — HITL pause. Compliance officer reviews in Wonderful Tasks.

Policy-driven decisions — natural language rules, not black-box ML

Built-in HITL — compliance officer approves/rejects in Tasks UI

Full audit trail — every step logged via task_add_event (6AMLD compliance)

Real sanctions data — OpenSanctions covers 450+ lists (EU/UN/OFAC/HMT)